--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 13:11:46 2006
+Date: Sat, 25 Mar 2006 22:07:28 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325210728.GX4053@stusta.de>
+Content-Disposition: inline
+Cc: Takashi Iwai <tiwai@suse.de>
+Subject: [stable] [-stable patch] Add default entry for CTL Travel Master U553W
+
+From: Takashi Iwai <tiwai@suse.de>
+
+Added the default entry of ALC880 configuration table for
+CTL Travel Master U553W.
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/pci/hda/patch_realtek.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- linux-2.6.16.1.orig/sound/pci/hda/patch_realtek.c
++++ linux-2.6.16.1/sound/pci/hda/patch_realtek.c
+@@ -2948,6 +2948,8 @@ static struct hda_board_config alc260_cf
+ { .modelname = "basic", .config = ALC260_BASIC },
+ { .pci_subvendor = 0x104d, .pci_subdevice = 0x81bb,
+ .config = ALC260_BASIC }, /* Sony VAIO */
++ { .pci_subvendor = 0x152d, .pci_subdevice = 0x0729,
++ .config = ALC260_BASIC }, /* CTL Travel Master U553W */
+ { .modelname = "hp", .config = ALC260_HP },
+ { .pci_subvendor = 0x103c, .pci_subdevice = 0x3010, .config = ALC260_HP },
+ { .pci_subvendor = 0x103c, .pci_subdevice = 0x3011, .config = ALC260_HP },
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 10:22:43 2006
+Date: Sat, 25 Mar 2006 19:22:27 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325182227.GL4053@stusta.de>
+Content-Disposition: inline
+Cc: linville@tuxdriver.com
+Subject: AIRO{,_CS} <-> CRYPTO fixes
+
+CRYPTO is a helper variable, and to make it easier for users, it should
+therefore select'ed and not be listed in the dependencies.
+
+drivers/net/wireless/airo.c requires CONFIG_CRYPTO for compilations.
+
+Therefore, AIRO_CS also has to select CRYPTO.
+
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/Kconfig | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig
++++ linux-2.6.16.1/drivers/net/wireless/Kconfig
+@@ -239,7 +239,8 @@ config IPW2200_DEBUG
+
+ config AIRO
+ tristate "Cisco/Aironet 34X/35X/4500/4800 ISA and PCI cards"
+- depends on NET_RADIO && ISA_DMA_API && CRYPTO && (PCI || BROKEN)
++ depends on NET_RADIO && ISA_DMA_API && (PCI || BROKEN)
++ select CRYPTO
+ ---help---
+ This is the standard Linux driver to support Cisco/Aironet ISA and
+ PCI 802.11 wireless cards.
+@@ -388,6 +389,7 @@ config PCMCIA_SPECTRUM
+ config AIRO_CS
+ tristate "Cisco/Aironet 34X/35X/4500/4800 PCMCIA cards"
+ depends on NET_RADIO && PCMCIA && (BROKEN || !M32R)
++ select CRYPTO
+ ---help---
+ This is the standard Linux driver to support Cisco/Aironet PCMCIA
+ 802.11 wireless cards. This driver is the same as the Aironet
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Apr 3 03:13:24 2006
+Date: Mon, 3 Apr 2006 20:11:57 +1000
+From: Anton Blanchard <anton@samba.org>
+To: stable@kernel.org
+Message-ID: <20060403101157.GB4704@krispykreme>
+Content-Disposition: inline
+Cc: clameter@sgi.com
+Subject: Fix NULL pointer dereference in node_read_numastat()
+
+From: Christoph Lameter <clameter@sgi.com>
+
+Fix NULL pointer dereference in node_read_numastat()
+
+zone_pcp() only returns valid values if the processor is online.
+
+Change node_read_numastat() to only scan online processors.
+
+Signed-off-by: Christoph Lameter <clameter@sgi.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/base/node.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.1.orig/drivers/base/node.c
++++ linux-2.6.16.1/drivers/base/node.c
+@@ -106,7 +106,7 @@ static ssize_t node_read_numastat(struct
+ other_node = 0;
+ for (i = 0; i < MAX_NR_ZONES; i++) {
+ struct zone *z = &pg->node_zones[i];
+- for (cpu = 0; cpu < NR_CPUS; cpu++) {
++ for_each_online_cpu(cpu) {
+ struct per_cpu_pageset *ps = zone_pcp(z,cpu);
+ numa_hit += ps->numa_hit;
+ numa_miss += ps->numa_miss;
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 13:11:46 2006
+Date: Sat, 25 Mar 2006 22:07:32 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325210732.GY4053@stusta.de>
+Content-Disposition: inline
+Cc: jketreno@linux.intel.com, yi.zhu@intel.com
+Subject: drivers/net/wireless/ipw2200.c: fix an array overun
+
+This patch fixes a big array overun found by the Coverity checker.
+
+This was already fixed in Linus' tree.
+
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/ipw2200.c | 5 ++---
+ 1 file changed, 2 insertions(+), 3 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/net/wireless/ipw2200.c
++++ linux-2.6.16.1/drivers/net/wireless/ipw2200.c
+@@ -9956,9 +9956,8 @@ static int ipw_ethtool_set_eeprom(struct
+ return -EINVAL;
+ down(&p->sem);
+ memcpy(&p->eeprom[eeprom->offset], bytes, eeprom->len);
+- for (i = IPW_EEPROM_DATA;
+- i < IPW_EEPROM_DATA + IPW_EEPROM_IMAGE_SIZE; i++)
+- ipw_write8(p, i, p->eeprom[i]);
++ for (i = 0; i < IPW_EEPROM_IMAGE_SIZE; i++)
++ ipw_write8(p, i + IPW_EEPROM_DATA, p->eeprom[i]);
+ up(&p->sem);
+ return 0;
+ }
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Mar 27 05:44:50 2006
+Message-ID: <4427E490.9010002@gmail.com>
+Date: Mon, 27 Mar 2006 21:11:44 +0800
+From: "Antonino A. Daplas" <adaplas@gmail.com>
+To: Andrew Morton <akpm@osdl.org>
+Cc: Linux Fbdev development list <linux-fbdev-devel@lists.sourceforge.net>,
+ stable@kernel.org, Herbert Poetzl <herbert@13thfloor.at>
+Subject: fbcon: Fix big-endian bogosity in slow_imageblit()
+
+The monochrome->color expansion routine that handles bitmaps which have
+(widths % 8) != 0 (slow_imageblit) produces corrupt characters in big-endian.
+This is caused by a bogus bit test in slow_imageblit().
+
+Fix.
+
+Signed-off-by: Antonino Daplas <adaplas@pol.net>
+Acked-by: Herbert Poetzl <herbert@13thfloor.at>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/video/cfbimgblt.c | 2 +-
+ include/linux/fb.h | 2 --
+ 2 files changed, 1 insertion(+), 3 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/video/cfbimgblt.c
++++ linux-2.6.16.1/drivers/video/cfbimgblt.c
+@@ -169,7 +169,7 @@ static inline void slow_imageblit(const
+
+ while (j--) {
+ l--;
+- color = (*s & 1 << (FB_BIT_NR(l))) ? fgcolor : bgcolor;
++ color = (*s & (1 << l)) ? fgcolor : bgcolor;
+ val |= FB_SHIFT_HIGH(color, shift);
+
+ /* Did the bitshift spill bits to the next long? */
+--- linux-2.6.16.1.orig/include/linux/fb.h
++++ linux-2.6.16.1/include/linux/fb.h
+@@ -839,12 +839,10 @@ struct fb_info {
+ #define FB_LEFT_POS(bpp) (32 - bpp)
+ #define FB_SHIFT_HIGH(val, bits) ((val) >> (bits))
+ #define FB_SHIFT_LOW(val, bits) ((val) << (bits))
+-#define FB_BIT_NR(b) (7 - (b))
+ #else
+ #define FB_LEFT_POS(bpp) (0)
+ #define FB_SHIFT_HIGH(val, bits) ((val) << (bits))
+ #define FB_SHIFT_LOW(val, bits) ((val) >> (bits))
+-#define FB_BIT_NR(b) (b)
+ #endif
+
+ /*
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Apr 4 13:26:53 2006
+Date: Tue, 04 Apr 2006 13:26:50 -0700 (PDT)
+Message-Id: <20060404.132650.110458870.davem@davemloft.net>
+To: stable@kernel.org
+From: "David S. Miller" <davem@davemloft.net>
+Cc:
+Subject: fib_trie.c node freeing fix
+
+
+Please apply to 2.6.{14,15,16} -stable, thanks a lot.
+
+From: Robert Olsson <robert.olsson@its.uu.se>
+
+[FIB_TRIE]: Fix leaf freeing.
+
+Seems like leaf (end-nodes) has been freed by __tnode_free_rcu and not
+by __leaf_free_rcu. This fixes the problem. Only tnode_free is now
+used which checks for appropriate node type. free_leaf can be removed.
+
+Signed-off-by: Robert Olsson <robert.olsson@its.uu.se>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/fib_trie.c | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+--- linux-2.6.16.1.orig/net/ipv4/fib_trie.c
++++ linux-2.6.16.1/net/ipv4/fib_trie.c
+@@ -314,11 +314,6 @@ static void __leaf_free_rcu(struct rcu_h
+ kfree(container_of(head, struct leaf, rcu));
+ }
+
+-static inline void free_leaf(struct leaf *leaf)
+-{
+- call_rcu(&leaf->rcu, __leaf_free_rcu);
+-}
+-
+ static void __leaf_info_free_rcu(struct rcu_head *head)
+ {
+ kfree(container_of(head, struct leaf_info, rcu));
+@@ -357,7 +352,12 @@ static void __tnode_free_rcu(struct rcu_
+
+ static inline void tnode_free(struct tnode *tn)
+ {
+- call_rcu(&tn->rcu, __tnode_free_rcu);
++ if(IS_LEAF(tn)) {
++ struct leaf *l = (struct leaf *) tn;
++ call_rcu_bh(&l->rcu, __leaf_free_rcu);
++ }
++ else
++ call_rcu(&tn->rcu, __tnode_free_rcu);
+ }
+
+ static struct leaf *leaf_new(void)
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 09:36:52 2006
+Date: Sat, 25 Mar 2006 18:36:37 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325173637.GH4053@stusta.de>
+Content-Disposition: inline
+Cc: Sergey Vlasov <vsu@altlinux.ru>, Christoph Hellwig <hch@lst.de>
+Subject: Fix module refcount leak in __set_personality()
+
+From: Sergey Vlasov <vsu@altlinux.ru>
+
+If the change of personality does not lead to change of exec domain,
+__set_personality() returned without releasing the module reference
+acquired by lookup_exec_domain().
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Sergey Vlasov <vsu@altlinux.ru>
+Cc: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Andrew Morton <akpm@osdl.org>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/exec_domain.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.1.orig/kernel/exec_domain.c
++++ linux-2.6.16.1/kernel/exec_domain.c
+@@ -140,6 +140,7 @@ __set_personality(u_long personality)
+ ep = lookup_exec_domain(personality);
+ if (ep == current_thread_info()->exec_domain) {
+ current->personality = personality;
++ module_put(ep->module);
+ return 0;
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Mar 27 13:02:01 2006
+Date: Sat, 25 Mar 2006 17:20:41 GMT
+Message-Id: <200603251720.k2PHKftM005117@hera.kernel.org>
+From: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
+To: git-commits-head@vger.kernel.org
+Cc:
+Subject: Fix the p4-clockmod N60 errata workaround.
+
+From: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+
+[CPUFREQ] Fix the p4-clockmod N60 errata workaround.
+
+Fix the code to disable freqs less than 2GHz in N60 errata.
+
+Signed-off-by: Venkatesh Pallipadi <venkatesh.pallipadi@intel.com>
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/cpu/cpufreq/p4-clockmod.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/p4-clockmod.c
+@@ -244,7 +244,7 @@ static int cpufreq_p4_cpu_init(struct cp
+ for (i=1; (p4clockmod_table[i].frequency != CPUFREQ_TABLE_END); i++) {
+ if ((i<2) && (has_N44_O17_errata[policy->cpu]))
+ p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
+- else if (has_N60_errata[policy->cpu] && p4clockmod_table[i].frequency < 2000000)
++ else if (has_N60_errata[policy->cpu] && ((stock_freq * i)/8) < 2000000)
+ p4clockmod_table[i].frequency = CPUFREQ_ENTRY_INVALID;
+ else
+ p4clockmod_table[i].frequency = (stock_freq * i)/8;
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Apr 1 16:07:45 2006
+Date: Sat, 1 Apr 2006 16:06:50 -0800
+From: Andrew Morton <akpm@osdl.org>
+To: stable@kernel.org
+Message-Id: <20060401160650.33ccbb3f.akpm@osdl.org>
+Cc: Kirill Korotaev <dev@openvz.org>
+Subject: wrong error path in dup_fd() leading to oopses in RCU
+
+
+
+From: Kirill Korotaev <dev@openvz.org>
+
+[PATCH] wrong error path in dup_fd() leading to oopses in RCU
+
+Wrong error path in dup_fd() - it should return NULL on error,
+not an address of already freed memory :/
+
+Triggered by OpenVZ stress test suite.
+
+What is interesting is that it was causing different oopses in RCU like
+below:
+Call Trace:
+ [<c013492c>] rcu_do_batch+0x2c/0x80
+ [<c0134bdd>] rcu_process_callbacks+0x3d/0x70
+ [<c0126cf3>] tasklet_action+0x73/0xe0
+ [<c01269aa>] __do_softirq+0x10a/0x130
+ [<c01058ff>] do_softirq+0x4f/0x60
+ =======================
+ [<c0113817>] smp_apic_timer_interrupt+0x77/0x110
+ [<c0103b54>] apic_timer_interrupt+0x1c/0x24
+ Code: Bad EIP value.
+ <0>Kernel panic - not syncing: Fatal exception in interrupt
+
+Signed-Off-By: Pavel Emelianov <xemul@sw.ru>
+Signed-Off-By: Dmitry Mishin <dim@openvz.org>
+Signed-Off-By: Kirill Korotaev <dev@openvz.org>
+Signed-Off-By: Linus Torvalds <torvalds@osdl.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/fork.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.1.orig/kernel/fork.c
++++ linux-2.6.16.1/kernel/fork.c
+@@ -720,7 +720,7 @@ out_release:
+ free_fdset (new_fdt->open_fds, new_fdt->max_fdset);
+ free_fd_array(new_fdt->fd, new_fdt->max_fds);
+ kmem_cache_free(files_cachep, newf);
+- goto out;
++ return NULL;
+ }
+
+ static int copy_files(unsigned long clone_flags, struct task_struct * tsk)
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Apr 3 01:50:32 2006
+Message-ID: <4430E134.3090000@trash.net>
+Date: Mon, 03 Apr 2006 10:47:48 +0200
+From: Patrick McHardy <kaber@trash.net>
+To: stable@kernel.org
+Cc:
+Subject: {ip, nf}_conntrack_netlink: fix expectation notifier unregistration
+
+
+From: Martin Josefsson <gandalf@wlug.westbo.se>
+
+[NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration
+
+This patch fixes expectation notifier unregistration on module unload to
+use ip_conntrack_expect_unregister_notifier(). This bug causes a soft
+lockup at the first expectation created after a rmmod ; insmod of this
+module.
+
+Should go into -stable as well.
+
+Signed-off-by: Martin Josefsson <gandalf@wlug.westbo.se>
+Signed-off-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ net/ipv4/netfilter/ip_conntrack_netlink.c | 2 +-
+ net/netfilter/nf_conntrack_netlink.c | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.1.orig/net/ipv4/netfilter/ip_conntrack_netlink.c
++++ linux-2.6.16.1/net/ipv4/netfilter/ip_conntrack_netlink.c
+@@ -1619,7 +1619,7 @@ static void __exit ctnetlink_exit(void)
+ printk("ctnetlink: unregistering from nfnetlink.\n");
+
+ #ifdef CONFIG_IP_NF_CONNTRACK_EVENTS
+- ip_conntrack_unregister_notifier(&ctnl_notifier_exp);
++ ip_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
+ ip_conntrack_unregister_notifier(&ctnl_notifier);
+ #endif
+
+--- linux-2.6.16.1.orig/net/netfilter/nf_conntrack_netlink.c
++++ linux-2.6.16.1/net/netfilter/nf_conntrack_netlink.c
+@@ -1641,7 +1641,7 @@ static void __exit ctnetlink_exit(void)
+ printk("ctnetlink: unregistering from nfnetlink.\n");
+
+ #ifdef CONFIG_NF_CONNTRACK_EVENTS
+- nf_conntrack_unregister_notifier(&ctnl_notifier_exp);
++ nf_conntrack_expect_unregister_notifier(&ctnl_notifier_exp);
+ nf_conntrack_unregister_notifier(&ctnl_notifier);
+ #endif
+
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Mar 31 13:09:30 2006
+Date: Fri, 31 Mar 2006 23:09:03 +0200
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060331210903.GC22677@stusta.de>
+Content-Disposition: inline
+Cc: maximilian attems <maks@sternwelten.at>
+Subject: isicom must select FW_LOADER
+
+From: maximilian attems <maks@sternwelten.at>
+
+The isicom driver uses request_firmware()
+and thus needs to select FW_LOADER.
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: maximilian attems <maks@sternwelten.at>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/char/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.1.orig/drivers/char/Kconfig
++++ linux-2.6.16.1/drivers/char/Kconfig
+@@ -187,6 +187,7 @@ config MOXA_SMARTIO
+ config ISI
+ tristate "Multi-Tech multiport card support (EXPERIMENTAL)"
+ depends on SERIAL_NONSTANDARD
++ select FW_LOADER
+ help
+ This is a driver for the Multi-Tech cards which provide several
+ serial ports. The driver is experimental and can currently only be
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Mar 27 13:02:45 2006
+Date: Sat, 25 Mar 2006 17:20:42 GMT
+Message-Id: <200603251720.k2PHKgrw005133@hera.kernel.org>
+From: Linux Kernel Mailing List <linux-kernel@vger.kernel.org>
+To: git-commits-head@vger.kernel.org
+Cc:
+Subject: [CPUFREQ] Mark longhaul driver as broken.
+
+From: Dave Jones <davej@redhat.com>
+
+[CPUFREQ] Mark longhaul driver as broken.
+This seems to work for a short period of time, but when
+used in conjunction with a userspace governor that changes
+the frequency regularly, it's only a matter of time before
+everything just locks up.
+
+Signed-off-by: Dave Jones <davej@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/i386/kernel/cpu/cpufreq/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.1.orig/arch/i386/kernel/cpu/cpufreq/Kconfig
++++ linux-2.6.16.1/arch/i386/kernel/cpu/cpufreq/Kconfig
+@@ -203,6 +203,7 @@ config X86_LONGRUN
+ config X86_LONGHAUL
+ tristate "VIA Cyrix III Longhaul"
+ select CPU_FREQ_TABLE
++ depends on BROKEN
+ help
+ This adds the CPUFreq driver for VIA Samuel/CyrixIII,
+ VIA Cyrix Samuel/C3, VIA Cyrix Ezra and VIA Cyrix Ezra-T
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Apr 3 08:46:35 2006
+Date: Mon, 3 Apr 2006 18:47:41 +0300
+From: "Michael S. Tsirkin" <mst@mellanox.co.il>
+To: stable@kernel.org, openib-general@openib.org, Adrian Bunk <bunk@stusta.de>
+Message-ID: <20060403154741.GB14808@mellanox.co.il>
+Content-Disposition: inline
+Cc:
+Subject: IPOB: Move destructor from neigh->ops to neigh_param
+
+From: Michael S. Tsirkin <mst@mellanox.co.il>
+
+struct neigh_ops currently has a destructor field, but not a constructor field.
+The infiniband/ulp/ipoib in-tree driver stashes some info in the neighbour
+structure (the results of the second-stage lookup from ARP results to real
+link-level path), and it uses neigh->ops->destructor to get a callback so it can
+clean up this extra info when a neighbour is freed. We've run into problems
+with this: since the destructor is in an ops field that is shared between
+neighbours that may belong to different net devices, there's no way to set/clear
+it safely.
+
+The following patch moves this field to neigh_parms where it can be safely set,
+together with its twin neigh_setup, and switches the only two in-kernel users
+(ipoib and clip) to this interface.
+
+Signed-off-by: Michael S. Tsirkin <mst@mellanox.co.il>
+Signed-off-by: Roland Dreier <rolandd@cisco.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_main.c | 16 +---------------
+ drivers/infiniband/ulp/ipoib/ipoib_multicast.c | 1 -
+ include/net/neighbour.h | 2 +-
+ net/atm/clip.c | 2 +-
+ net/core/neighbour.c | 4 ++--
+ 5 files changed, 5 insertions(+), 20 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_main.c
++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_main.c
+@@ -247,7 +247,6 @@ static void path_free(struct net_device
+ if (neigh->ah)
+ ipoib_put_ah(neigh->ah);
+ *to_ipoib_neigh(neigh->neighbour) = NULL;
+- neigh->neighbour->ops->destructor = NULL;
+ kfree(neigh);
+ }
+
+@@ -530,7 +529,6 @@ static void neigh_add_path(struct sk_buf
+ err:
+ *to_ipoib_neigh(skb->dst->neighbour) = NULL;
+ list_del(&neigh->list);
+- neigh->neighbour->ops->destructor = NULL;
+ kfree(neigh);
+
+ ++priv->stats.tx_dropped;
+@@ -769,21 +767,9 @@ static void ipoib_neigh_destructor(struc
+ ipoib_put_ah(ah);
+ }
+
+-static int ipoib_neigh_setup(struct neighbour *neigh)
+-{
+- /*
+- * Is this kosher? I can't find anybody in the kernel that
+- * sets neigh->destructor, so we should be able to set it here
+- * without trouble.
+- */
+- neigh->ops->destructor = ipoib_neigh_destructor;
+-
+- return 0;
+-}
+-
+ static int ipoib_neigh_setup_dev(struct net_device *dev, struct neigh_parms *parms)
+ {
+- parms->neigh_setup = ipoib_neigh_setup;
++ parms->neigh_destructor = ipoib_neigh_destructor;
+
+ return 0;
+ }
+--- linux-2.6.16.1.orig/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
++++ linux-2.6.16.1/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+@@ -115,7 +115,6 @@ static void ipoib_mcast_free(struct ipoi
+ if (neigh->ah)
+ ipoib_put_ah(neigh->ah);
+ *to_ipoib_neigh(neigh->neighbour) = NULL;
+- neigh->neighbour->ops->destructor = NULL;
+ kfree(neigh);
+ }
+
+--- linux-2.6.16.1.orig/include/net/neighbour.h
++++ linux-2.6.16.1/include/net/neighbour.h
+@@ -68,6 +68,7 @@ struct neigh_parms
+ struct net_device *dev;
+ struct neigh_parms *next;
+ int (*neigh_setup)(struct neighbour *);
++ void (*neigh_destructor)(struct neighbour *);
+ struct neigh_table *tbl;
+
+ void *sysctl_table;
+@@ -145,7 +146,6 @@ struct neighbour
+ struct neigh_ops
+ {
+ int family;
+- void (*destructor)(struct neighbour *);
+ void (*solicit)(struct neighbour *, struct sk_buff*);
+ void (*error_report)(struct neighbour *, struct sk_buff*);
+ int (*output)(struct sk_buff*);
+--- linux-2.6.16.1.orig/net/atm/clip.c
++++ linux-2.6.16.1/net/atm/clip.c
+@@ -289,7 +289,6 @@ static void clip_neigh_error(struct neig
+
+ static struct neigh_ops clip_neigh_ops = {
+ .family = AF_INET,
+- .destructor = clip_neigh_destroy,
+ .solicit = clip_neigh_solicit,
+ .error_report = clip_neigh_error,
+ .output = dev_queue_xmit,
+@@ -346,6 +345,7 @@ static struct neigh_table clip_tbl = {
+
+ /* parameters are copied from ARP ... */
+ .parms = {
++ .neigh_destructor = clip_neigh_destroy,
+ .tbl = &clip_tbl,
+ .base_reachable_time = 30 * HZ,
+ .retrans_time = 1 * HZ,
+--- linux-2.6.16.1.orig/net/core/neighbour.c
++++ linux-2.6.16.1/net/core/neighbour.c
+@@ -586,8 +586,8 @@ void neigh_destroy(struct neighbour *nei
+ kfree(hh);
+ }
+
+- if (neigh->ops && neigh->ops->destructor)
+- (neigh->ops->destructor)(neigh);
++ if (neigh->parms->neigh_destructor)
++ (neigh->parms->neigh_destructor)(neigh);
+
+ skb_queue_purge(&neigh->arp_queue);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 10:49:56 2006
+Date: Sat, 25 Mar 2006 19:49:42 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325184942.GN4053@stusta.de>
+Content-Disposition: inline
+Cc: Takashi Iwai <tiwai@suse.de>
+Subject: opti9x - Fix compile without CONFIG_PNP
+
+From: Takashi Iwai <tiwai@suse.de>
+
+Modules: Opti9xx drivers
+
+Fix compile errors without CONFIG_PNP.
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Takashi Iwai <tiwai@suse.de>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ sound/isa/opti9xx/opti92x-ad1848.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- linux-2.6.16.1.orig/sound/isa/opti9xx/opti92x-ad1848.c
++++ linux-2.6.16.1/sound/isa/opti9xx/opti92x-ad1848.c
+@@ -2088,9 +2088,11 @@ static int __init alsa_card_opti9xx_init
+ int error;
+ struct platform_device *device;
+
++#ifdef CONFIG_PNP
+ pnp_register_card_driver(&opti9xx_pnpc_driver);
+ if (snd_opti9xx_pnp_is_probed)
+ return 0;
++#endif
+ if (! is_isapnp_selected()) {
+ error = platform_driver_register(&snd_opti9xx_driver);
+ if (error < 0)
+@@ -2102,7 +2104,9 @@ static int __init alsa_card_opti9xx_init
+ }
+ platform_driver_unregister(&snd_opti9xx_driver);
+ }
++#ifdef CONFIG_PNP
+ pnp_unregister_card_driver(&opti9xx_pnpc_driver);
++#endif
+ #ifdef MODULE
+ printk(KERN_ERR "no OPTi " CHIP_NAME " soundcard found\n");
+ #endif
+@@ -2115,7 +2119,9 @@ static void __exit alsa_card_opti9xx_exi
+ platform_device_unregister(snd_opti9xx_platform_device);
+ platform_driver_unregister(&snd_opti9xx_driver);
+ }
++#ifdef CONFIG_PNP
+ pnp_unregister_card_driver(&opti9xx_pnpc_driver);
++#endif
+ }
+
+ module_init(alsa_card_opti9xx_init)
--- /dev/null
+From stable-bounces@linux.kernel.org Tue Apr 4 09:14:25 2006
+Date: Tue, 4 Apr 2006 10:12:43 +0200
+From: Dominik Brodowski <linux@dominikbrodowski.net>
+To: stable@kernel.org
+Message-ID: <20060404081243.GA11755@dominikbrodowski.de>
+Content-Disposition: inline
+Cc: linux-pcmcia@lists.infradead.org
+Subject: pcmcia: permit single-character-identifiers
+
+From: Janos Farkas <chexum@gmail.com>
+
+For some time, the core pcmcia drivers seem not to think single
+character prod_ids are valid, thus preventing the "cleverly" named
+
+ "D" "Link DWL-650 11Mbps WLAN Card"
+
+Before (as in 2.6.16):
+PRODID_1=""
+PRODID_2="Link DWL-650 11Mbps WLAN Card"
+PRODID_3="Version 01.02"
+PRODID_4=""
+MANFID=0156,0002
+FUNCID=6
+
+After (with the patch)
+PRODID_1="D"
+PRODID_2="Link DWL-650 11Mbps WLAN Card"
+PRODID_3="Version 01.02"
+PRODID_4=""
+MANFID=0156,0002
+FUNCID=6
+
+Signed-off-by: Janos Farkas <chexum@gmail.com>
+Signed-off-by: Dominik Brodowski <linux@dominikbrodowski.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/pcmcia/ds.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- linux-2.6.16.1.orig/drivers/pcmcia/ds.c
++++ linux-2.6.16.1/drivers/pcmcia/ds.c
+@@ -546,7 +546,7 @@ static int pcmcia_device_query(struct pc
+ tmp = vers1->str + vers1->ofs[i];
+
+ length = strlen(tmp) + 1;
+- if ((length < 3) || (length > 255))
++ if ((length < 2) || (length > 255))
+ continue;
+
+ p_dev->prod_id[i] = kmalloc(sizeof(char) * length,
--- /dev/null
+From stable-bounces@linux.kernel.org Fri Mar 31 08:34:11 2006
+Date: Fri, 31 Mar 2006 18:33:45 +0200
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060331163345.GJ3893@stusta.de>
+Content-Disposition: inline
+Cc: linville@tuxdriver.com
+Subject: PCMCIA_SPECTRUM must select FW_LOADER
+
+PCMCIA_SPECTRUM must select FW_LOADER.
+
+Reported by "Alexander E. Patrakov" <patrakov@ums.usu.ru>.
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/net/wireless/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- linux-2.6.16.1.orig/drivers/net/wireless/Kconfig
++++ linux-2.6.16.1/drivers/net/wireless/Kconfig
+@@ -374,6 +374,7 @@ config PCMCIA_HERMES
+ config PCMCIA_SPECTRUM
+ tristate "Symbol Spectrum24 Trilogy PCMCIA card support"
+ depends on NET_RADIO && PCMCIA && HERMES
++ select FW_LOADER
+ ---help---
+
+ This is a driver for 802.11b cards using RAM-loadable Symbol
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Apr 3 05:24:25 2006
+Date: Mon, 3 Apr 2006 22:23:15 +1000
+From: Anton Blanchard <anton@samba.org>
+To: stable@kernel.org
+Message-ID: <20060403122315.GA18668@krispykreme>
+Content-Disposition: inline
+Cc: sfr@canb.auug.org.au
+Subject: powerpc: make ISA floppies work again
+
+
+From: Stephen Rothwell <sfr@canb.auug.org.au>
+
+We used to assume that a DMA mapping request with a NULL dev was for
+ISA DMA. This assumption was broken at some point. Now we explicitly
+pass the detected ISA PCI device in the floppy setup.
+
+Signed-off-by: Stephen Rothwell <sfr@canb.auug.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ arch/powerpc/kernel/pci_64.c | 1 +
+ include/asm-powerpc/floppy.h | 5 +++--
+ 2 files changed, 4 insertions(+), 2 deletions(-)
+
+--- linux-2.6.16.1.orig/arch/powerpc/kernel/pci_64.c
++++ linux-2.6.16.1/arch/powerpc/kernel/pci_64.c
+@@ -78,6 +78,7 @@ int global_phb_number; /* Global phb co
+
+ /* Cached ISA bridge dev. */
+ struct pci_dev *ppc64_isabridge_dev = NULL;
++EXPORT_SYMBOL_GPL(ppc64_isabridge_dev);
+
+ static void fixup_broken_pcnet32(struct pci_dev* dev)
+ {
+--- linux-2.6.16.1.orig/include/asm-powerpc/floppy.h
++++ linux-2.6.16.1/include/asm-powerpc/floppy.h
+@@ -35,6 +35,7 @@
+ #ifdef CONFIG_PCI
+
+ #include <linux/pci.h>
++#include <asm/ppc-pci.h> /* for ppc64_isabridge_dev */
+
+ #define fd_dma_setup(addr,size,mode,io) powerpc_fd_dma_setup(addr,size,mode,io)
+
+@@ -52,12 +53,12 @@ static __inline__ int powerpc_fd_dma_set
+ if (bus_addr
+ && (addr != prev_addr || size != prev_size || dir != prev_dir)) {
+ /* different from last time -- unmap prev */
+- pci_unmap_single(NULL, bus_addr, prev_size, prev_dir);
++ pci_unmap_single(ppc64_isabridge_dev, bus_addr, prev_size, prev_dir);
+ bus_addr = 0;
+ }
+
+ if (!bus_addr) /* need to map it */
+- bus_addr = pci_map_single(NULL, addr, size, dir);
++ bus_addr = pci_map_single(ppc64_isabridge_dev, addr, size, dir);
+
+ /* remember this one as prev */
+ prev_addr = addr;
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Apr 1 12:00:59 2006
+Date: Sat, 1 Apr 2006 21:11:41 +0200 (CEST)
+From: Stefan Richter <stefanr@s5r6.in-berlin.de>
+To: Linus Torvalds <torvalds@osdl.org>
+Message-ID: <tkrat.11bf8809a766b402@s5r6.in-berlin.de>
+Content-Disposition: INLINE
+Cc: Jody McIntyre <scjody@modernduck.com>,
+ linux1394-devel@lists.sourceforge.net, stable@kernel.org,
+ linux-kernel@vger.kernel.org
+Subject: sbp2: fix spinlock recursion
+
+sbp2util_mark_command_completed takes a lock which was already taken by
+sbp2scsi_complete_all_commands. This is a regression in Linux 2.6.15.
+Reported by Kristian Harms at
+https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=187394
+
+Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/ieee1394/sbp2.c | 32 +++++++++++++++-----------------
+ 1 file changed, 15 insertions(+), 17 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/ieee1394/sbp2.c
++++ linux-2.6.16.1/drivers/ieee1394/sbp2.c
+@@ -495,22 +495,17 @@ static struct sbp2_command_info *sbp2uti
+ /*
+ * This function finds the sbp2_command for a given outstanding SCpnt.
+ * Only looks at the inuse list.
++ * Must be called with scsi_id->sbp2_command_orb_lock held.
+ */
+-static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(struct scsi_id_instance_data *scsi_id, void *SCpnt)
++static struct sbp2_command_info *sbp2util_find_command_for_SCpnt(
++ struct scsi_id_instance_data *scsi_id, void *SCpnt)
+ {
+ struct sbp2_command_info *command;
+- unsigned long flags;
+
+- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+- if (!list_empty(&scsi_id->sbp2_command_orb_inuse)) {
+- list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list) {
+- if (command->Current_SCpnt == SCpnt) {
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
++ if (!list_empty(&scsi_id->sbp2_command_orb_inuse))
++ list_for_each_entry(command, &scsi_id->sbp2_command_orb_inuse, list)
++ if (command->Current_SCpnt == SCpnt)
+ return command;
+- }
+- }
+- }
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+ return NULL;
+ }
+
+@@ -579,17 +574,15 @@ static void sbp2util_free_command_dma(st
+
+ /*
+ * This function moves a command to the completed orb list.
++ * Must be called with scsi_id->sbp2_command_orb_lock held.
+ */
+-static void sbp2util_mark_command_completed(struct scsi_id_instance_data *scsi_id,
+- struct sbp2_command_info *command)
++static void sbp2util_mark_command_completed(
++ struct scsi_id_instance_data *scsi_id,
++ struct sbp2_command_info *command)
+ {
+- unsigned long flags;
+-
+- spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ list_del(&command->list);
+ sbp2util_free_command_dma(command);
+ list_add_tail(&command->list, &scsi_id->sbp2_command_orb_completed);
+- spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+ }
+
+ /*
+@@ -2177,7 +2170,9 @@ static int sbp2_handle_status_write(stru
+ * Matched status with command, now grab scsi command pointers and check status
+ */
+ SCpnt = command->Current_SCpnt;
++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ sbp2util_mark_command_completed(scsi_id, command);
++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+
+ if (SCpnt) {
+
+@@ -2513,6 +2508,7 @@ static int sbp2scsi_abort(struct scsi_cm
+ (struct scsi_id_instance_data *)SCpnt->device->host->hostdata[0];
+ struct sbp2scsi_host_info *hi = scsi_id->hi;
+ struct sbp2_command_info *command;
++ unsigned long flags;
+
+ SBP2_ERR("aborting sbp2 command");
+ scsi_print_command(SCpnt);
+@@ -2523,6 +2519,7 @@ static int sbp2scsi_abort(struct scsi_cm
+ * Right now, just return any matching command structures
+ * to the free pool.
+ */
++ spin_lock_irqsave(&scsi_id->sbp2_command_orb_lock, flags);
+ command = sbp2util_find_command_for_SCpnt(scsi_id, SCpnt);
+ if (command) {
+ SBP2_DEBUG("Found command to abort");
+@@ -2540,6 +2537,7 @@ static int sbp2scsi_abort(struct scsi_cm
+ command->Current_done(command->Current_SCpnt);
+ }
+ }
++ spin_unlock_irqrestore(&scsi_id->sbp2_command_orb_lock, flags);
+
+ /*
+ * Initiate a fetch agent reset.
tlclk-fix-handling-of-device-major.patch
usb-0079-Fix-irda-usb-use-after-use.patch
sysfs-off-by-one.patch
+usb-ehci-full-speed-iso-bugfixes.patch
+usb-usbcore-usb_set_configuration-oops.patch
+sbp2-fix-spinlock-recursion.patch
+powerpc-make-isa-floppies-work-again.patch
+pcmcia_spectrum-must-select-fw_loader.patch
+pcmcia-permit-single-character-identifiers.patch
+opti9x-fix-compile-without-config_pnp.patch
+move-destructor-from-neigh-ops-to.patch
+mark-longhaul-driver-as-broken.patch
+isicom-must-select-fw_loader.patch
+ip.patch
+fw-wrong-error-path-in-dup_fd-leading-to-oopses.patch
+fix-the-p4-clockmod-n60-errata-workaround.patch
+fix-module-refcount-leak-in.patch
+fib_trie.c-node-freeing-fix.patch
+fbcon-fix-big-endian-bogosity-in.patch
+drivers-net-wireless-ipw2200.c-fix-an.patch
+clameter-sgi.com-re-fw-2.6.16-crashes-when-running.patch
+airo-_cs-crypto-fixes.patch
+add-default-entry-for-ctl-travel-master.patch
fs/sysfs/file.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
---- gregkh-2.6.orig/fs/sysfs/file.c
-+++ gregkh-2.6/fs/sysfs/file.c
+--- linux-2.6.16.1.orig/fs/sysfs/file.c
++++ linux-2.6.16.1/fs/sysfs/file.c
@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer *
return -ENOMEM;
drivers/char/tlclk.c | 1 +
1 file changed, 1 insertion(+)
---- linux-2.6.16.orig/drivers/char/tlclk.c
-+++ linux-2.6.16/drivers/char/tlclk.c
+--- linux-2.6.16.1.orig/drivers/char/tlclk.c
++++ linux-2.6.16.1/drivers/char/tlclk.c
@@ -767,6 +767,7 @@ static int __init tlclk_init(void)
printk(KERN_ERR "tlclk: can't get major %d.\n", tlclk_major);
return ret;
drivers/net/irda/irda-usb.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
---- linux-2.6.16.orig/drivers/net/irda/irda-usb.c
-+++ linux-2.6.16/drivers/net/irda/irda-usb.c
+--- linux-2.6.16.1.orig/drivers/net/irda/irda-usb.c
++++ linux-2.6.16.1/drivers/net/irda/irda-usb.c
@@ -740,7 +740,7 @@ static void irda_usb_receive(struct urb
struct sk_buff *newskb;
struct sk_buff *dataskb;
--- /dev/null
+From david-b@pacbell.net Fri Jan 20 17:25:14 2006
+From: Clemens Ladisch <clemens@ladisch.de>
+To: Greg KH <greg@kroah.com>
+Subject: USB: EHCI full speed ISO bugfixes
+Date: Fri, 20 Jan 2006 13:49:10 -0800
+Cc: <clemens@ladisch.de>
+Message-Id: <200601201349.10841.david-b@pacbell.net>
+
+
+This patch replaces the split ISO raw_mask calculation code in the
+iso_stream_init() function that computed incorrect numbers of high
+speed transactions for both input and output transfers.
+
+In the output case, it added a superfluous start-split transaction for
+all maxmimum packet sizes that are a multiple of 188.
+
+In the input case, it forgot to add complete-split transactions for all
+microframes covered by the full speed transaction, and the additional
+complete-split transaction needed for the case when full speed data
+starts arriving near the end of a microframe.
+
+These changes don't affect the lack of full speed bandwidth, but at
+least it removes the MMF errors that the HC raised with some input
+streams.
+
+Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
+Signed-off-by: David Brownell <dbrownell@users.sourceforge.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ drivers/usb/host/ehci-sched.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/usb/host/ehci-sched.c
++++ linux-2.6.16.1/drivers/usb/host/ehci-sched.c
+@@ -707,6 +707,7 @@ iso_stream_init (
+ } else {
+ u32 addr;
+ int think_time;
++ int hs_transfers;
+
+ addr = dev->ttport << 24;
+ if (!ehci_is_TDI(ehci)
+@@ -719,6 +720,7 @@ iso_stream_init (
+ think_time = dev->tt ? dev->tt->think_time : 0;
+ stream->tt_usecs = NS_TO_US (think_time + usb_calc_bus_time (
+ dev->speed, is_input, 1, maxp));
++ hs_transfers = max (1u, (maxp + 187) / 188);
+ if (is_input) {
+ u32 tmp;
+
+@@ -727,12 +729,11 @@ iso_stream_init (
+ stream->usecs = HS_USECS_ISO (1);
+ stream->raw_mask = 1;
+
+- /* pessimistic c-mask */
+- tmp = usb_calc_bus_time (USB_SPEED_FULL, 1, 0, maxp)
+- / (125 * 1000);
+- stream->raw_mask |= 3 << (tmp + 9);
++ /* c-mask as specified in USB 2.0 11.18.4 3.c */
++ tmp = (1 << (hs_transfers + 2)) - 1;
++ stream->raw_mask |= tmp << (8 + 2);
+ } else
+- stream->raw_mask = smask_out [maxp / 188];
++ stream->raw_mask = smask_out [hs_transfers - 1];
+ bandwidth = stream->usecs + stream->c_usecs;
+ bandwidth /= 1 << (interval + 2);
+
--- /dev/null
+From stable-bounces@linux.kernel.org Sat Mar 25 10:13:35 2006
+Date: Sat, 25 Mar 2006 19:13:13 +0100
+From: Adrian Bunk <bunk@stusta.de>
+To: stable@kernel.org
+Message-ID: <20060325181312.GK4053@stusta.de>
+Content-Disposition: inline
+Cc: Alan Stern <stern@rowland.harvard.edu>,
+ Greg Kroah-Hartman <gregkh@suse.de>,
+ Horst Schirmeier <horst@schirmeier.com>
+Subject: USB: usbcore: usb_set_configuration oops (NULL ptr dereference)
+
+When trying to deconfigure a device via usb_set_configuration(dev, 0),
+2.6.16-rc kernels after 55c527187c9d78f840b284d596a0b298bc1493af oops
+with "Unable to handle NULL pointer dereference at...". This is due to
+an unchecked dereference of cp in the power budget part.
+
+This patch was already included in Linus' tree.
+
+Signed-off-by: Horst Schirmeier <horst@schirmeier.com>
+Acked-by: Alan Stern <stern@rowland.harvard.edu>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+Signed-off-by: Adrian Bunk <bunk@stusta.de>
+
+---
+ drivers/usb/core/message.c | 12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- linux-2.6.16.1.orig/drivers/usb/core/message.c
++++ linux-2.6.16.1/drivers/usb/core/message.c
+@@ -1388,11 +1388,13 @@ free_interfaces:
+ if (dev->state != USB_STATE_ADDRESS)
+ usb_disable_device (dev, 1); // Skip ep0
+
+- i = dev->bus_mA - cp->desc.bMaxPower * 2;
+- if (i < 0)
+- dev_warn(&dev->dev, "new config #%d exceeds power "
+- "limit by %dmA\n",
+- configuration, -i);
++ if (cp) {
++ i = dev->bus_mA - cp->desc.bMaxPower * 2;
++ if (i < 0)
++ dev_warn(&dev->dev, "new config #%d exceeds power "
++ "limit by %dmA\n",
++ configuration, -i);
++ }
+
+ if ((ret = usb_control_msg(dev, usb_sndctrlpipe(dev, 0),
+ USB_REQ_SET_CONFIGURATION, 0, configuration, 0,
projects / thirdparty / kernel / stable-queue.git / commitdiff
